Wordpress Attack Underway-Upgrade if you can - GoFuckYourself.com

docputer · 09-05-2009, 08:39 AM

If you?re running a self-hosted WordPress (WordPress) blog that isn?t up-to-date (version 2.8.4), you?re advised to upgrade immediately to the latest version of the software to avoid an ongoing attack. Users of WordPress.com hosted blogs are not affected.
This message came from Lorelle at Wordpress after it was discovered that a nasty attack is exploiting security holes in previous versions of the blogging software, creating a new ?hidden? Administrator account and getting right down to the database level. These attacks are said to be ?growing by the hour?. Lorelle writes:

There are two clues that your WordPress site has been attacked.

There are strange additions to the pretty permalinks, such as example.com/category/post-title/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_REFER ER%5D))%7D%7D|.+)&%/. The keywords are ?eval? and ?base64_decode.?

The second clue is that a ?back door? was created by a ?hidden? Administrator. Check your site users for ?Administrator (2)? or a name you do not recognize. You will probably be unable to access that account.

All users are advised to upgrade to the latest version of WP, while those already affected are in for a trying weekend: you?ll likely need to export your all your content with the built-in XML WordPress export, uninstall and reinstall WordPress and re-import the content. It?s a nasty attack that goes all the way into the database, so exporting the database will result in exporting the hacked code too.

For those unaffected: upgrade today.
http://mashable.com/2009/09/05/wordpress-attack/

Cyber Fucker · 09-05-2009, 08:48 AM

Thx for the info! Sounds like wordpress is having more and more security holes recently...

TheSenator · 09-05-2009, 08:52 AM

ok...I plugged up my site months ago....

Another layer of security is renaming your table prefix.

Use this tool to help you.
http://semperfiwebdesign.com/custom-...security-scan/

09-05-2009, 08:53 AM

Wordpress is a pile of shit anyway.

Jdoughs · 09-05-2009, 08:57 AM

If you're running an old version you are just asking for it, this doesn't affect anyone who is up to date with updates.

Hotrocket · 09-05-2009, 10:36 AM

I'm pretty sure fris posted about this like 2 weeks ago...lol

Agent 488 · 09-05-2009, 10:43 AM

i'm pretty sure it was another hack ... lol.

Quote:

Originally Posted by Hotrocket

I'm pretty sure fris posted about this like 2 weeks ago...lol

Scotty.T · 09-05-2009, 10:47 AM

Quote:

Originally Posted by Hotrocket

I'm pretty sure fris posted about this like 2 weeks ago...lol

I'm pretty sure fris' post about this 2 weeks ago was a different exploit.

ladida · 09-05-2009, 11:56 AM

Quote:

Originally Posted by docputer

The keywords are “eval” and “base64_decode.”

Those are just shell parameters that can be changed at any time. Wouldn't call those keywords for detection, rather the chars infront, which looks like they found a regexp and escaped from it (%&(%7B$%7B).

woj · 09-05-2009, 12:04 PM

these hacks happen all the time, nothing new

09-05-2009, 08:39 AM	#1
docputer Confirmed User Industry Role: Join Date: Jun 2006 Posts: 1,103	Wordpress Attack Underway-Upgrade if you can If you?re running a self-hosted WordPress (WordPress) blog that isn?t up-to-date (version 2.8.4), you?re advised to upgrade immediately to the latest version of the software to avoid an ongoing attack. Users of WordPress.com hosted blogs are not affected. This message came from Lorelle at Wordpress after it was discovered that a nasty attack is exploiting security holes in previous versions of the blogging software, creating a new ?hidden? Administrator account and getting right down to the database level. These attacks are said to be ?growing by the hour?. Lorelle writes: There are two clues that your WordPress site has been attacked. There are strange additions to the pretty permalinks, such as example.com/category/post-title/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_REFER ER%5D))%7D%7D\|.+)&%/. The keywords are ?eval? and ?base64_decode.? The second clue is that a ?back door? was created by a ?hidden? Administrator. Check your site users for ?Administrator (2)? or a name you do not recognize. You will probably be unable to access that account. All users are advised to upgrade to the latest version of WP, while those already affected are in for a trying weekend: you?ll likely need to export your all your content with the built-in XML WordPress export, uninstall and reinstall WordPress and re-import the content. It?s a nasty attack that goes all the way into the database, so exporting the database will result in exporting the hacked code too. For those unaffected: upgrade today. http://mashable.com/2009/09/05/wordpress-attack/ Last edited by docputer; 09-05-2009 at 08:43 AM..

09-05-2009, 08:48 AM	#2
Cyber Fucker Hmm Industry Role: Join Date: Sep 2005 Location: On an endless road around the world for rock and roll. Posts: 12,642	Thx for the info! Sounds like wordpress is having more and more security holes recently... __________________

09-05-2009, 08:52 AM	#3
TheSenator Too lazy to set a custom title Industry Role: Join Date: Feb 2003 Location: NJ Posts: 13,331	ok...I plugged up my site months ago.... Another layer of security is renaming your table prefix. Use this tool to help you. http://semperfiwebdesign.com/custom-...security-scan/ __________________ ISeekGirls.com since 2005

09-05-2009, 08:57 AM	#5
Jdoughs Confirmed User Industry Role: Join Date: Mar 2004 Location: Great White North Posts: 5,794	If you're running an old version you are just asking for it, this doesn't affect anyone who is up to date with updates. __________________ LinkSpun - Premier Adult Link Trading Community - ICQ - 464/\281/\250 Be Seen By New Webmasters/Affiliates * Target out webmasters/affiliates based on niches your sites are for less than $20 a month. AmeriNOC - Proudly hosted @ AmeriNOC!

09-05-2009, 12:04 PM	#10
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,882	these hacks happen all the time, nothing new __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

09-05-2009, 08:53 AM	#4
Killswitch - BANNED FOR LIFE Guest Posts: n/a	Wordpress is a pile of shit anyway.

09-05-2009, 10:36 AM	#6
Hotrocket Confirmed User Join Date: May 2004 Posts: 1,327	I'm pretty sure fris posted about this like 2 weeks ago...lol